Fix leaving a group from the client

https://github.com/hypothesis/h/commit/46e4bbadc991d550ca9706b5237e35d68675a6cc
made a breaking change to the public API of the endpoint for removing
the current user from a group by renaming the "user" path parameter to
"userid".

Given that this change has been out for some time, I have opted to fix
the client rather than revert the change in the service.

Fixes #774

Update core-js

Add aria label to share button in client menu

In addition to adding the label, this changes the <a> to a <button> as well.
Fixes https://github.com/hypothesis/product-backlog/issues/780

Fetch config via postMessage RPC if `requestConfigFromFrame` is set

This causes the client to fetch settings from an ancestor frame on
startup if necessary.

Implement `fetchConfig` function which fetches config from the host page
/ embedding web app and merges it with config rendered into the sidebar
HTML page.

This function supports a new method of fetching config from the embedder
by performing a "requestSidebarConfig" RPC call to the origin set with
the "requestSidebarConfigFromFrameWithOrigin" setting. That setting must
itself by set in the page where the embed.js script is loaded.

Also extract the `assertPromiseIsRejected` helper into `promise-util.js`
for re-use and add a note about needing to return the result.

Read sidebar app config asynchronously on startup

Add client for making JSON-RPC calls over postMessage

In preparation for introducing an optional new postMessage-based method
for the sidebar app to fetch configuration from its embedder, make the
setting fetch flow async.

- Move the Angular app startup logic into a function which receives
  settings as an argument.
- Add a function to merge config rendered into the sidebar app HTML
  page with config fetched asynchronously from a host frame.

Add "requestConfigFromFrame" string setting

Without this field all the test cases still pass, but for the wrong
reason, since the origin field is checked before other event properties.

Replace "var" with "const" or "let" everywhere

Update our JS standard library polyfills to the latest stable release.

This setting will cause the sidebar app to fetch its configuration via
a postMessage request to frames with the given origin on startup.

The setting is not actually used yet. This is coming in future commits.

We need a way for the client to request configuration from an embedding
frame over `postMessage`.

JSON-RPC is a well-known, simple and convenient format for RPC messages.

There are several npm packages which claim to offer this functionality
but at the time of writing, none appeared to be sufficiently well
tested/supported/documented.

There is an existing partial postMessage JSON-RPC server implementation in
src/sidebar/cross-origin-rpc.js. The non-app specific parts of that will
be moved into this module in future.

To ensure consistency going forwards, enforce usage of const/let

Fix the uses which js-codemod's "no vars" transform was unable to change
automatically.

This is the result of using jscodeshift [1] to apply the "no-vars"
transform from js-codemod [2] on all code in scripts/ and to gulpfile.js

[1] https://github.com/facebook/jscodeshift
[2] https://github.com/cpojer/js-codemod

This is the result of using jscodeshift [1] to apply the "no-vars"
transform from js-codemod [2] on all code in src/ except for
src/{annotator, sidebar}/vendor.

[1] https://github.com/facebook/jscodeshift
[2] https://github.com/cpojer/js-codemod

Add documentation for externalContainerSelector

Update to Node 10 for Jenkins and Travis builds

The official Docker node builds now have Yarn preinstalled, so use that
instead of a community-provided image.

Use `yarn version --minor` to bump the package version.

This requires Yarn >= v1.7.0.

Inject a default organization into groups objects without organizations

Create annotation when clicking "Annotate" button label